An insecure direct object reference flaw in PhotoPrism allows any user with a valid preview token to retrieve the original‑resolution cover photo for any album. The AlbumCover handler does not validate that the requester is authorized to view the requested album, permitting users to enumerate and download other users’ cover images.

PhotoPrism PhotoPrism installations are affected; no specific version range is listed, so any deployment that may still be running older or unpatched code could be vulnerable.

The CVSS score of 4.3 indicates moderate severity. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog. The likely attack vector is an HTTP request to the AlbumCover endpoint that accepts a preview token. An attacker only needs a valid preview token – typically obtained during normal browsing – to enumerate and download cover images. Because no privilege escalation or complex conditions are required, exploitation is straightforward for any user who holds such a token. The absence of an official patch means the vulnerability will remain exploitable until a vendor fix is released.